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CLAIMS 

It is claimed: 

1. A method of generating processed traffic, the method comprising 
providing a test scenario for generating a stream of encrypted traffic 
generating data units in accordance with the test scenario at a first rate 
encrypting the data units at a second rate 

encapsulating the data units at a third rate 
holding the encapsulated data units 

releasing and transmitting at a fourth rate the held data units as the stream of 
encrypted traffic 

wherein the fourth rate is greater than a sum of the first rate, the second rate and the 
third rate. 

2. The method of generating processed traffic of claim 1 wherein the test scenario 
specifies that the traffic should be sent to at least one host within a receiving subnet protected 
by a first gateway having an address, the method further comprising 

providing a holding gateway having an address configured as protecting the receiving 

subnet 

transmitting the encrypted traffic to the address of the first gateway 
diverting the encrypted traffic from the first gateway to the holding gateway, 
the holding gateway capturing the encrypted traffic, and causing the captured traffic to 
be stored 
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when a sufficient amount of stored traffic has been stored 
removing the holding gateway 

releasing the captured traffic, whereby the released traffic is transmitted to the 

first gateway. 

3. The method of generating processed traffic of claim 2 wherein the holding gateway 
has an alias address which is the same as the address of the first gateway. 

4. The method of generating processed traffic of claim 2 wherein the test scenario 
specifies that the traffic should be sent from at least one host within a generating subnet, the 
method further comprising 

providing an encrypting gateway having an address configured as protecting the 
generating subnet 

the encrypting gateway 

encrypting the traffic 

encapsulating the encrypted traffic to go to the first gateway. 

5. A method of generating processed traffic, the method comprising 

providing traffic for transmission to a first endpoint, the traffic comprising plural data 

units 

processing the provided traffic 

holding the processed traffic until a predefined amount of processed traffic has 
accumulated 

releasing the held traffic for transmission to the first endpoint. 
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6. The method of generating processed traffic of claim 5 wherein the processing 
comprises encrypting at least part of the data units. 

7. The method of generating processed traffic of claim 5 wherein the predefined amount 
A is determined according to 

A >= r * t, wherein 

ris the rate of transmission 

t is a length in time of the transmission. 

8. The method of generating processed traffic of claim 5 further comprising transmitting 
the held traffic at a first rate, wherein the first rate is greater than a second rate for providing 
the traffic and processing the provided traffic. 

9. The method of generating processed traffic of claim 5 wherein the processing 
comprises application-layer processing. 

10. A method of generating processed traffic, the method comprising 

receiving traffic at a first rate, the traffic comprising plural data units, the data units 
including an address and a payload 
holding the received traffic 
decrypting the held traffic 
analyzing the decrypted traffic 

wherein the decrypting and analyzing is performed at a second rate which is less than 
the first rate. 
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11. An apparatus for generating processed traffic, the apparatus comprising: 
a processor 

a memory 

wherein the processor and the memory comprise circuits and software for 
receiving a test scenario for generating a stream of encrypted traffic 
generating data units in accordance with the test scenario at a first rate 
encrypting the data units at a second rate 
encapsulating the data units at a third rate 
holding the encapsulated data units 

releasing and transmitting at a fourth rate the held data units as the stream of 
encrypted traffic 

wherein the fourth rate is greater than a sum of the first rate, the second rate and the 
third rate. 

12. The apparatus for generating processed traffic of claim 1 1 wherein the test scenario 
specifies that the traffic should be sent to at least one host within a receiving subnet protected 
by a first gateway having an address, the processor and the memory comprising circuits and 
software further for 

providing a holding gateway having an address configured as protecting the receiving 

subnet 

transmitting the encrypted traffic to the address of the first gateway 
diverting the encrypted traffic from the first gateway to the holding gateway. 
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the holding gateway capturing the encrypted traffic, and causing the captured traffic to 
be stored 

when a sufficient amount of stored traffic has been stored 
removing the holding gateway 

releasing the captured traffic, whereby the released traffic is transmitted to the 

first gateway. 

13. The apparatus for generating processed traffic of claim 12 wherein the holding 
gateway has an alias address which is the same as the address of the first gateway. 

14. The apparatus for generating processed traffic of claim 12 wherein the test scenario 
specifies that the traffic should be sent from at least one host within a generating subnet, the 
processor and the memory comprising circuits and software further for 

providing an encrypting gateway having an address configured as protecting the 
generating subnet 

the encrypting gateway 

encrypting the traffic 

encapsulating the encrypted traffic to go to the first gateway. 

15. An apparatus for generating processed traffic, the apparatus comprising: 
a processor 

a memory 

wherein the processor and the memory comprise circuits and software for 
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providing traffic for transmission to a first endpoint, the traffic comprising 
plural data units 

processing the provided traffic 

holding the processed traffic until a predefined amount of processed traffic has 

accumulated 

releasing the held traffic for transmission to the first endpoint. 

16. The apparatus for generating processed traffic of claim 15 wherein the processing 
comprises encrypting at least part of the data units. 

17. The apparatus for generating processed traffic of claim 15 wherein the predefined 
amount A is determined according to 

A >= r * t 5 wherein 

r is the rate of transmission 

t is a length in time of the transmission. 

18. The apparatus for generating processed traffic of claim 15, the processor and the 
memory comprising circuits and software further for transmitting the held traffic at a first 
rate, wherein the first rate is greater than a second rate for providing the traffic and processing 
the provided traffic. 

19. The apparatus for generating processed traffic of claim 15 wherein the processing 
comprises application-layer processing. 

20. An apparatus for generating processed traffic, the apparatus comprising: 
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a processor 
a memory 

wherein the processor and the memory comprise circuits and software for 

receiving traffic at a first rate, the traffic comprising plural data units, the data 
units including an address and a payload 
holding the received traffic 
decrypting the held traffic 
analyzing the decrypted traffic 
wherein the decrypting and analyzing is performed at a second rate which is less than 
the first rate. 

21. A storage medium having instructions stored thereon which when executed by a 
processor cause the processor to generate processed traffic comprising: 

receiving a test scenario for generating a stream of encrypted traffic 

generating data units in accordance with the test scenario at a first rate 

encrypting the data units at a second rate 

encapsulating the data units at a third rate 

holding the encapsulated data units 

releasing and transmitting at a fourth rate the held data units as the stream of 
encrypted traffic 

wherein the fourth rate is greater than a sum of the first rate, the second rate and the 
third rate. 
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22. The storage medium of claim 21 wherein the test scenario specifies that the traffic 
should be sent to at least one host within a receiving subnet protected by a first gateway 
having an address, the instructions further for 

providing a holding gateway having an address configured as protecting the receiving 

subnet 

transmitting the encrypted traffic to the address of the first gateway 
diverting the encrypted traffic from the first gateway to the holding gateway, 
the holding gateway capturing the encrypted traffic, and causing the captured traffic to 
be stored 

when a sufficient amount of stored traffic has been stored 
removing the holding gateway 

releasing the captured traffic, whereby the released traffic is transmitted to the 

first gateway. 

23. The storage medium of claim 22 wherein the holding gateway has an alias address 
which is the same as the address of the first gateway. 

24. The storage medium of claim 22 wherein the test scenario specifies that the traffic 
should be sent from at least one host within a generating subnet, the instructions further for 

providing an encrypting gateway having an address configured as protecting the 
generating subnet 

the encrypting gateway 

encrypting the traffic 
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encapsulating the encrypted traffic to go to the first gateway. 

25. A storage medium having instructions stored thereon which when executed by a 
processor cause the processor to generate processed traffic comprising: 

providing traffic for transmission to a first endpoint, the traffic comprising plural data 

units 

processing the provided traffic 

holding the processed traffic until a predefined amount of processed traffic has 
accumulated 

releasing the held traffic for transmission to the first endpoint. 

26. The storage medium of claim 25 wherein the processing comprises encrypting at least 
part of the data units. 

27. The storage medium of claim 25 wherein the predefined amount A is determined 
according to 

A >= r * t, wherein 

r is the rate of transmission 

t is a length in time of the transmission. 

28. The storage medium of claim 25, the instructions further for transmitting the held 
traffic at a first rate, wherein the first rate is greater than a second rate for providing the traffic 
and processing the provided traffic. 
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29. The storage medium of claim 25 wherein the processing comprises application-layer 
processing. 

30. A storage medium having instructions stored thereon which when executed by a 
processor cause the processor to generate processed traffic comprising: 

receiving traffic at a first rate, the traffic comprising plural data units, the data units 
including an address and a payload 
holding the received traffic 
decrypting the held traffic 
analyzing the decrypted traffic 

wherein the decrypting and analyzing is performed at a second rate which is less than 
the first rate. 

31. A computing device to generate processed traffic, the computing device comprising: 
a processor 

a memory coupled with the processor 

a storage medium having instructions stored thereon which when executed cause the 
computing device to perform actions comprising 

receiving a test scenario for generating a stream of encrypted traffic 
generating data units in accordance with the test scenario at a first rate 
encrypting the data units at a second rate 
encapsulating the data units at a third rate 
holding the encapsulated data units 
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releasing and transmitting at a fourth rate the held data units as the stream of 
encrypted traffic 

wherein the fourth rate is greater than a sum of the first rate, the second rate and the 
third rate. 

32. The computing device to generate processed traffic of claim 31 wherein the test 
scenario specifies that the traffic should be sent to at least one host within a receiving subnet 
protected by a first gateway having an address, the instructions further for 

providing a holding gateway having an address configured as protecting the receiving 

subnet 

transmitting the encrypted traffic to the address of the first gateway 
diverting the encrypted traffic from the first gateway to the holding gateway, 
the holding gateway capturing the encrypted traffic, and causing the captured traffic to 
be stored 

when a sufficient amount of stored traffic has been stored 
removing the holding gateway 

releasing the captured traffic, whereby the released traffic is transmitted to the 

first gateway. 

33. The computing device to generate processed traffic of claim 32 wherein the holding 
gateway has an alias address which is the same as the address of the first gateway. 
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34. The computing device to generate processed traffic of claim 32 wherein the test 
scenario specifies that the traffic should be sent from at least one host within a generating 
subnet, the instructions further for 

providing an encrypting gateway having an address configured as protecting the 
generating subnet 

the encrypting gateway 

encrypting the traffic 

encapsulating the encrypted traffic to go to the first gateway. 

35. A computing device to generate processed traffic, the computing device comprising: 
a processor 

a memory coupled with the processor 

a storage medium having instructions stored thereon which when executed cause the 
computing device to perform actions comprising 

receiving traffic for transmission to a first endpoint, the traffic comprising 
plural data units 

processing the provided traffic 

holding the processed traffic until a predefined amount of processed traffic has 

accumulated 

releasing the held traffic for transmission to the first endpoint. 

36. The computing device to generate processed traffic of claim 35 wherein the 
processing comprises encrypting at least part of the data units. 
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37. The computing device to generate processed traffic of claim 35 wherein the 
predefined amount A is determined according to 

A >= r * t, wherein 

r is the rate of transmission 

t is a length in time of the transmission. 

38. The computing device to generate processed traffic of claim 35, the instructions 
further for transmitting the held traffic at a first rate, wherein the first rate is greater than a 
second rate for providing the traffic and processing the provided traffic. 

39. The computing device to generate processed traffic of claim 35 wherein the 
processing comprises application-layer processing. 

40. A computing device to generate processed traffic, the computing device comprising: 
a processor 

a memory coupled with the processor 

a storage medium having instructions stored thereon which when executed cause the 
computing device to perform actions comprising 

receiving traffic at a first rate, the traffic comprising plural data units, the data 
units including an address and a payload 

holding the received traffic 

decrypting the held traffic 

analyzing the decrypted traffic 
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wherein the decrypting and analyzing is performed at a second rate which is less than 
the first rate. 



